8ed750e973
- Add write_logd, read_logd and control_logd macros added along with contexts for user space logd. - Specify above on domain wide, or service-by-service basis - Add logd rules. - deprecate access_logcat as unused. - 'allow <domain> zygote:unix_dgram_socket write;' rule added to deal with fd inheritance. ToDo: investigate means to allow references to close, and reopen in context of application or call setsockcreatecon() to label them in child context. Change-Id: I35dbb9d5122c5ed9b8c8f128abf24a871d6b26d8
197 lines
6.9 KiB
Text
197 lines
6.9 KiB
Text
# Rules for all domains.
|
|
|
|
# Allow reaping by init.
|
|
allow domain init:process sigchld;
|
|
|
|
# Read access to properties mapping.
|
|
allow domain kernel:fd use;
|
|
allow domain tmpfs:file { read getattr };
|
|
|
|
# Search /storage/emulated tmpfs mount.
|
|
allow domain tmpfs:dir r_dir_perms;
|
|
|
|
# Intra-domain accesses.
|
|
allow domain self:process ~{ execmem execstack execheap ptrace };
|
|
allow domain self:fd use;
|
|
allow domain self:dir r_dir_perms;
|
|
allow domain self:lnk_file r_file_perms;
|
|
allow domain self:{ fifo_file file } rw_file_perms;
|
|
allow domain self:{ unix_dgram_socket unix_stream_socket } *;
|
|
|
|
# Inherit or receive open files from others.
|
|
allow domain init:fd use;
|
|
allow domain system_server:fd use;
|
|
|
|
# Connect to adbd and use a socket transferred from it.
|
|
# This is used for e.g. adb backup/restore.
|
|
allow domain adbd:unix_stream_socket connectto;
|
|
allow domain adbd:fd use;
|
|
allow domain adbd:unix_stream_socket { getattr getopt read write shutdown };
|
|
|
|
userdebug_or_eng(`
|
|
# Same as adbd rules above, except allow su to do the same thing
|
|
allow domain su:unix_stream_socket connectto;
|
|
allow domain su:fd use;
|
|
allow domain su:unix_stream_socket { getattr getopt read write shutdown };
|
|
|
|
# Running something like "pm dump com.android.bluetooth" requires
|
|
# fifo writes
|
|
allow domain su:fifo_file { write getattr };
|
|
|
|
# allow "gdbserver --attach" to work for su.
|
|
allow domain su:process sigchld;
|
|
')
|
|
|
|
###
|
|
### Talk to debuggerd.
|
|
###
|
|
allow domain debuggerd:process sigchld;
|
|
allow domain debuggerd:unix_stream_socket connectto;
|
|
|
|
# Root fs.
|
|
allow domain rootfs:dir r_dir_perms;
|
|
allow domain rootfs:file r_file_perms;
|
|
allow domain rootfs:lnk_file r_file_perms;
|
|
|
|
# Device accesses.
|
|
allow domain device:dir search;
|
|
allow domain dev_type:lnk_file r_file_perms;
|
|
allow domain devpts:dir search;
|
|
allow domain device:file read;
|
|
allow domain socket_device:dir search;
|
|
allow domain owntty_device:chr_file rw_file_perms;
|
|
allow domain null_device:chr_file rw_file_perms;
|
|
allow domain zero_device:chr_file r_file_perms;
|
|
allow domain ashmem_device:chr_file rw_file_perms;
|
|
allow domain binder_device:chr_file rw_file_perms;
|
|
allow domain ptmx_device:chr_file rw_file_perms;
|
|
allow domain log_device:dir search;
|
|
allow domain log_device:chr_file rw_file_perms;
|
|
allow domain alarm_device:chr_file r_file_perms;
|
|
allow domain urandom_device:chr_file rw_file_perms;
|
|
allow domain random_device:chr_file rw_file_perms;
|
|
allow domain properties_device:file r_file_perms;
|
|
|
|
# logd access
|
|
write_logd(domain)
|
|
|
|
# Filesystem accesses.
|
|
allow domain fs_type:filesystem getattr;
|
|
allow domain fs_type:dir getattr;
|
|
|
|
# System file accesses.
|
|
allow domain system_file:dir r_dir_perms;
|
|
allow domain system_file:file r_file_perms;
|
|
allow domain system_file:file execute;
|
|
allow domain system_file:lnk_file r_file_perms;
|
|
|
|
# Read files already opened under /data.
|
|
allow domain system_data_file:dir { search getattr };
|
|
allow domain system_data_file:file { getattr read };
|
|
allow domain system_data_file:lnk_file r_file_perms;
|
|
|
|
# Read apk files under /data/app.
|
|
allow domain apk_data_file:dir { getattr search };
|
|
allow domain apk_data_file:file r_file_perms;
|
|
|
|
# Read /data/dalvik-cache.
|
|
allow domain dalvikcache_data_file:dir { search getattr };
|
|
allow domain dalvikcache_data_file:file r_file_perms;
|
|
|
|
# Read already opened /cache files.
|
|
allow domain cache_file:dir r_dir_perms;
|
|
allow domain cache_file:file { getattr read };
|
|
allow domain cache_file:lnk_file r_file_perms;
|
|
|
|
# Read timezone related information
|
|
r_dir_file(domain, zoneinfo_data_file)
|
|
|
|
# For /acct/uid/*/tasks.
|
|
allow domain cgroup:dir { search write };
|
|
allow domain cgroup:file w_file_perms;
|
|
|
|
#Allow access to ion memory allocation device
|
|
allow domain ion_device:chr_file rw_file_perms;
|
|
|
|
# Read access to pseudo filesystems.
|
|
r_dir_file(domain, proc)
|
|
r_dir_file(domain, sysfs)
|
|
r_dir_file(domain, sysfs_devices_system_cpu)
|
|
r_dir_file(domain, inotify)
|
|
r_dir_file(domain, cgroup)
|
|
r_dir_file(domain, proc_net)
|
|
|
|
# debugfs access
|
|
allow domain debugfs:dir r_dir_perms;
|
|
allow domain debugfs:file w_file_perms;
|
|
|
|
# Get SELinux enforcing status.
|
|
selinux_getenforce(domain)
|
|
|
|
# security files
|
|
allow domain security_file:dir { search getattr };
|
|
allow domain security_file:file getattr;
|
|
|
|
######## Backwards compatibility - Unlabeled files ############
|
|
|
|
# Revert to DAC rules when looking at unlabeled files. Over time, the number
|
|
# of unlabeled files should decrease.
|
|
# TODO: delete these rules in the future.
|
|
#
|
|
# Note on relabelfrom: We allow any app relabelfrom, but without the relabelto
|
|
# capability, it's essentially useless. This is needed to allow an app with
|
|
# relabelto to relabel unlabeled files.
|
|
#
|
|
allow domain unlabeled:notdevfile_class_set { create_file_perms relabelfrom };
|
|
allow domain unlabeled:dir { create_dir_perms relabelfrom };
|
|
neverallow { domain -relabeltodomain } *:dir_file_class_set relabelto;
|
|
|
|
###
|
|
### neverallow rules
|
|
###
|
|
|
|
neverallow domain self:capability2 mac_override;
|
|
neverallow { domain -recovery } self:capability2 mac_admin;
|
|
|
|
# Only init should be able to load SELinux policies.
|
|
# The first load technically occurs while still in the kernel domain,
|
|
# but this does not trigger a denial since there is no policy yet.
|
|
# Policy reload requires allowing this to the init domain.
|
|
neverallow { domain -init } kernel:security load_policy;
|
|
|
|
# Only init prior to switching context should be able to set enforcing mode.
|
|
# init starts in kernel domain and switches to init domain via setcon in
|
|
# the init.rc, so the setenforce occurs while still in kernel. After
|
|
# switching domains, there is never any need to setenforce again by init.
|
|
neverallow { domain -kernel } kernel:security { setenforce setcheckreqprot };
|
|
|
|
# Only init, ueventd and system_server should be able to access HW RNG
|
|
neverallow { domain -init -system_server -ueventd -unconfineddomain } hw_random_device:chr_file *;
|
|
|
|
# Ensure that all entrypoint executables are in exec_type.
|
|
neverallow domain { file_type -exec_type }:file entrypoint;
|
|
|
|
# Ensure that nothing in userspace can access /dev/mem or /dev/kmem
|
|
neverallow { domain -kernel -ueventd -init } kmem_device:chr_file *;
|
|
neverallow domain kmem_device:chr_file ~{ create relabelto unlink setattr };
|
|
|
|
# Only init should be able to configure kernel usermodehelpers or
|
|
# security-sensitive proc settings.
|
|
neverallow { domain -init } usermodehelper:file { append write };
|
|
neverallow { domain -init } proc_security:file { append write };
|
|
|
|
# No domain should be allowed to ptrace init.
|
|
neverallow domain init:process ptrace;
|
|
|
|
# Init can't receive binder calls. If this neverallow rule is being
|
|
# triggered, it's probably due to a service with no SELinux domain.
|
|
neverallow domain init:binder call;
|
|
|
|
# Don't allow raw read/write/open access to block_device
|
|
# Rather force a relabel to a more specific type
|
|
neverallow { domain -unconfineddomain -vold } block_device:blk_file { open read write };
|
|
|
|
# Don't allow raw read/write/open access to generic devices.
|
|
# Rather force a relabel to a more specific type.
|
|
# ueventd is exempt from this, as its managing these devices.
|
|
neverallow { domain -unconfineddomain -ueventd } device:chr_file { open read write };
|